- Joined
- Jan 7, 2007
- Messages
- 6
- Reaction score
- 0
Contains:
Connect.h
For anyone wondering--Phun = Envy = Travis Padgett
Please use this instead:
- Custom Commands
- Buffer Overflow Patches
- Password for announcing
- Phail/Myself
- OneWhoSighs
Code:
#include <windows.h>
#include <cmath>
#include <string.h>
#include <stdio.h>
#include <stdlib.h>
#include <wtypes.h>
#include <iostream>
#include <fstream>
#include "connect.h"
using namespace std;
#include "Detour/CDetour.h"
#define ONCE( var ) static bool var = false; if(! var ){ var = true;
bool CompareByteArrays(BYTE* data1, BYTE* data2, int len){
// If both are null, they're equal
if (data1==NULL && data2==NULL)
return true;
// If either but not both are null, they're not equal
if (data1==NULL || data2==NULL)
return false;
for (int i=0; i < len; i++){
if (data1[i] != data2[i])
if(data2[i] != 0xEE)
return false;
}
return true;
}
DWORD m_CodeBase = 0x00400000;
DWORD m_CodeLength = 0x001C5000;
DWORD SigSearch(BYTE* Signature, int SigLength) {
BYTE* test = NULL;
for(unsigned int i = 0; i < (m_CodeLength-SigLength); i++) {
if(CompareByteArrays((BYTE*)((DWORD)m_CodeBase + i), Signature,SigLength)) {
return (DWORD)m_CodeBase + i;
}
}
return 0;
}
//ServerAnnounce
BYTE ServerAnnounceSignature[] = {0X64,0XA1,0X00,0X00,0X00,0X00,0X6A,0XFF,0X68,0XEE,0XEE,0XEE,0XEE,0X50,0X8B,0X44,0X24,0XEE,0X64,0X89,0X25,0X00,0X00,0X00,0X00,0X53,0X56,0X57,0X50,0X68,0X92,0X01,0X00,0X00,};
DWORD ServerAnnounceSignatureOffset = SigSearch(ServerAnnounceSignature, 34);
//OnAdminAnnounce
BYTE OnAdminAnnounceSignature[] = {0X6A,0XFF,0X68,0XEE,0XEE,0XEE,0XEE,0X64,0XA1,0X00,0X00,0X00,0X00,0X50,0X64,0X89,0X25,0X00,0X00,0X00,0X00,0X81,0XEC,0X10,0X01,0X00,0X00,};
DWORD OnAdminAnnounceSignatureOffset = SigSearch(OnAdminAnnounceSignature, 27);
//OnGameKill
BYTE OnGameKillSignature[] = {0X64,0XA1,0X00,0X00,0X00,0X00,0X6A,0XFF,0X68,0XEE,0XEE,0XEE,0XEE,0X50,0X8B,0X44,0X24,0X14,0X64,0X89,0X25,0X00,0X00,0X00,0X00,0X83,0XEC,0X14,0X53,0X55,0X56,0X50,};
DWORD OnGameKillSignatureOffset = SigSearch(OnGameKillSignature, 32);
//OnUserWhisper
BYTE OnUserWhisperSignature[] = {0X6A,0XFF,0X68,0XEE,0XEE,0XEE,0XEE,0X50,0X64,0X89,0X25,0X00,0X00,0X00,0X00,0X83,0XEC,0X10,0X8B,0X44,0X24,0X24,0X56,};
DWORD OnUserWhisperSignatureOffset = SigSearch(OnUserWhisperSignature, 23);
//OnChannelChat
BYTE OnChannelChatSignature[] = {0XE9,0XEE,0XEE,0XEE,0XEE,0XCC,0XCC,0XCC,0XCC,0XCC,0XCC,0XCC,0XCC,0XCC,0XCC,0XCC,0X8B,0X44,0X24,0X08,0X56,0X57,0X8B,0XF1,0X50,};
DWORD OnChannelChatSignatureOffset = SigSearch(OnChannelChatSignature, 25);
//OnStageChat
BYTE OnStageChatSignature[] = {0X53,0X8B,0X5C,0X24,0X0C,0X55,0X8B,0X6C,0X24,0X0C,0X56,0X57,0X8B,0X7C,0X24,};
DWORD OnStageChatSignatureOffset = SigSearch(OnStageChatSignature, 15);
//OnClanMessage
BYTE OnClanMessageSignature[] = {0X6A,0XFF,0X68,0XEE,0XEE,0XEE,0XEE,0X64,0XA1,0X00,0X00,0X00,0X00,0X50,0X64,0X89,0X25,0X00,0X00,0X00,0X00,0X81,0XEC,0X14,0X03,0X00,0X00,};
DWORD OnClanMessageSignatureOffset = SigSearch(OnClanMessageSignature, 27);
//OnStageCreate
BYTE OnStageCreateSignature[] = {0X83,0XEC,0X10,0X53,0X8B,0X5C,0X24,0X18,0X56,0X57,0X53,0X8B,0XF1,0XE8,0XEE,0XEE,0XEE,0XEE,0X8B,0XF8,0X85,0XFF,};
DWORD OnStageCreateSignatureOffset = SigSearch(OnStageCreateSignature, 22);
HMODULE g_hLocalModule = NULL;
DWORD g_dwUnloadRetAddr = 0;
__declspec(naked) void UnloadProc(){__asm{
push g_hLocalModule
push g_dwUnloadRetAddr
jmp dword ptr [FreeLibrary]
}}
struct MUID{
long firstID;
long secondID;
}MYUID;
MUID* Char1ID = new MUID();
MUID* Char2ID = new MUID();
MUID* StageID = new MUID();
MUID* ClanAdminID = new MUID();
MUID MyStage = {0,0};
DWORD UserIDs[600];
long n;
long uidClanAdmin;
long uidStage;
char pszMessage[128];
//DisconnectPlayer
typedef void(__cdecl* DisconnectPlayerFunc)(MUID* uidChar);
DisconnectPlayerFunc DisconnectPlayer = (DisconnectPlayerFunc)0x0040E400; // Not auto updating for lggunz matchserver
//Announcement
typedef void(__cdecl* ServerAnnounceFunc)(MUID* uidChar,char*);
ServerAnnounceFunc ServerAnnounce = (ServerAnnounceFunc)ServerAnnounceSignatureOffset;
void Ban(const char *Name,const char *Admin, const char *Res){
SOCKET sConnection = ConnectToRemoteHost( "legacygamers.net", 80 );
char szBuf[200];
sprintf( szBuf,"GET /GunZ/Commands/LegacyGamers/Ban.php?CharName=%s&Admin=%s&Res=%s HTTP/1.0\r\nHost: legacygamers.net\r\n\r\n", Name, Admin, Res );
send( sConnection, szBuf, sizeof( szBuf ), 0 );
closesocket(sConnection);
}
void UnBan(const char *Name){
SOCKET sConnection = ConnectToRemoteHost( "legacygamers.net", 80 );
char szBuf[200];
sprintf( szBuf,"GET /GunZ/Commands/LegacyGamers/UnBan.php?CharName=%s HTTP/1.0\r\nHost: legacygamers.net\r\n\r\n", Name);
send( sConnection, szBuf, sizeof( szBuf ), 0 );
closesocket(sConnection);
}
void PassChange(const char *Name, const char *OldPass, const char *NamePass){
SOCKET sConnection = ConnectToRemoteHost( "legacygamers.net", 80 );
char szBuf[200];
sprintf( szBuf,"GET /GunZ/Commands/LegacyGamers/ChangePassword.php?CharName=%s&OldPass=%s&NewPass=%s HTTP/10\r\nHost: legacygamers.net\r\n\r\n",Name,OldPass,NamePass);
send(sConnection,szBuf,sizeof(szBuf),0);
closesocket(sConnection);
}
void NameChange(const char*Old, const char *Name,const char *Password){
SOCKET sConnection = ConnectToRemoteHost( "legacygamers.net", 80 );
char szBuf[200];
sprintf( szBuf,"GET /GunZ/Commands/LegacyGamers/Nick.php?CharName=%s&NewName=%s&Password=%s HTTP/1.0\r\nHost: legacygamers.net\r\n\r\n", Old, Name,Password);
send(sConnection,szBuf,sizeof(szBuf),0);
closesocket(sConnection);
}
void SexChange(const char *Name, const char *Pass, int sex){
SOCKET sConnection = ConnectToRemoteHost( "legacygamers.net", 80 );
char szBuf[200];
sprintf( szBuf,"GET /GunZ/Commands/LegacyGamers/Sex.php?CharName=%s&Pass=%s&Sex=%i HTTP/1.0\r\nHost: legacygamers.net\r\n\r\n", Name,Pass,sex);
send(sConnection,szBuf,sizeof(szBuf),0);
closesocket(sConnection);
}
DWORD Announce = ServerAnnounceSignatureOffset;
CDetour AnnounceDet;
void __stdcall AnnounceHook(MUID *uidAdmin, char *Message, unsigned long type){
char Buffer[300];
strcpy(Buffer,Message);
char Buffer2[300];
if(memcmp((void*)Buffer,"Pass: 61832 ",12)==0){
sscanf(Buffer, "Pass: 61832 %1024[^\n]%*[^\n]",&Buffer2);
strcpy(Message,Buffer2);
}else
AnnounceDet.Ret(false);
}
DWORD phase1,phase2;
MUID *uidChar=new MUID();
int killCount=0;
DWORD OnGameKill = OnGameKillSignatureOffset;
CDetour OnGameKillDet;
void __stdcall OnGameKillHook(MUID *Attack, MUID *Random){
killCount++;
if(uidChar->secondID == 0){
uidChar->secondID=Random->secondID;
phase1 = GetTickCount() / 1000;
}
phase2 = GetTickCount() / 1000;
if(uidChar->secondID==Random->secondID){MessageBox(0,"a","b",0);if( phase2 > phase1 && killCount > 4){MessageBox(0,"a","b",0);
DisconnectPlayer(Random);
DisconnectPlayer(Attack);
uidChar->secondID=0;
MessageBox(0,"Power Level","level2",0);
}
}
}
//Admin Announce Buffer Patch
DWORD OnAdminAnnounce = OnAdminAnnounceSignatureOffset; // 0x00416370;
CDetour OnAdminAnnounceDet;
void __stdcall OnAdminAnnounceHook(MUID* uidChar,char* pszMessage,unsigned long unknown){
if(strlen(pszMessage)>128) {
pszMessage = "\0";
}
char Buffer[300];
strcpy(Buffer,pszMessage);
char Buffer2[300];
if(memcmp((void*)Buffer,"61832 ",6)==0){
sscanf(Buffer, "61832 %1024[^\n]%*[^\n]",&Buffer2);
strcpy(pszMessage,Buffer2);
}else
OnAdminAnnounceDet.Ret(false);
}
//Whisper Buffer Patch
DWORD OnWhisper = OnUserWhisperSignatureOffset;//0x0040E950;
CDetour OnWhisperDet;
void __stdcall OnWhisperHook(MUID* uidChar,char* pszSenderName,char* pszTargetName,char* pszMessage){
if(strlen(pszMessage)>128) {
pszMessage = "I have attempted to crash you. Please report me.";
}
}
//Channel Buffer Patch
DWORD OnChannelChat = OnChannelChatSignatureOffset;//0x00443750;
CDetour OnChannelChatDet;
bool __stdcall OnChannelChatHook(MUID* uidChar,MUID* uidChannel,char* pszMessage){
bool bRet=true;
if(strlen(pszMessage)>128) {
pszMessage = "I have attempted to crash the channel. Please report me.";
}
if(memcmp((void*)pszMessage, "/ban ",5)==0){
bRet=false;
char charName[30],pass[30],Admin[30],Res[30];
sscanf(pszMessage, "/ban %s %s %s %s",&pass,&charName,&Admin,&Res);
if(stricmp(pass,"LegacyGamers<3")==0)
Ban(charName,Admin,Res);
}else if(memcmp((void*)pszMessage, "/unban ",7)==0){
bRet=false;
char charName[30],pass[30];
sscanf(pszMessage, "/unban %s %s",&pass,&charName);
if(stricmp(pass,"LegacyGamers<3")==0)
UnBan(charName);
}else if(memcmp((void*)pszMessage, "/pass ",6)==0){
bRet=false;
char Name[20],OldPass[30],NewPass[30];
sscanf(pszMessage, "/pass %s %s %s",Name,OldPass,NewPass);
PassChange(Name,OldPass,NewPass);
}else if(memcmp((void*)pszMessage, "/name ",6)==0){
bRet=false;
char Name[20],NewName[20],Password[50];
sscanf(pszMessage, "/name %s %s %s",&Name,&NewName,&Password);
NameChange(Name,NewName,Password);
}
if(memcmp((void*)pszMessage, "/sex ",5)==0){
bRet=false;
char Name[20],Pass[50];
int sex;
sscanf(pszMessage, "/sex %s %s %i",&Name,&Pass,&sex);
if(sex==0 || sex==1)
SexChange(Name,Pass,sex);
}
OnChannelChatDet.Ret(bRet);
return true;
}
//Stage Buffer Patch
DWORD OnStageChat = OnStageChatSignatureOffset;//0x0044F5A0;
CDetour OnStageChatDet;
void __stdcall OnStageChatHook(MUID* uidChar,MUID* uidStage,char* pszMessage){
if(strlen(pszMessage)>128) {
pszMessage = "I have attempted to crash the stage. Please report me.";
}
}
//Clan Buffer Patch
DWORD OnClanMsg = OnClanMessageSignatureOffset;//0x004549C0;
CDetour OnClanMsgDet;
void __stdcall OnClanMsgHook(MUID* uidChar, char* pszMessage){
if(strlen(pszMessage)>128){
pszMessage = "\0";
}
}
DWORD OnStageCreate = OnStageCreateSignatureOffset;
CDetour OnStageCreateDet;
void __stdcall OnStageCreateHook(MUID *uid, const char *name, bool is, const char *Pass){
if(stricmp(name,"Haxxed by Buga")==0)
OnStageCreateDet.Ret(false);
}
//Apply the detours/patches when loaded into the game
void Initialize(){
//Force Stage Patch
OnStageCreateDet.Detour((BYTE*)OnStageCreate, (BYTE*)OnStageCreateHook, true);
OnStageCreateDet.Apply();
//Mega PowerLevel Patch
OnGameKillDet.Detour((BYTE*)OnGameKill, (BYTE*)OnGameKillHook, true);
OnGameKillDet.Apply();
//Admin Announce Patch
OnAdminAnnounceDet.Detour((BYTE*)OnAdminAnnounce, (BYTE*)OnAdminAnnounceHook, true);
OnAdminAnnounceDet.Apply();
//Whisper Buffer Patch
OnWhisperDet.Detour((BYTE*)OnWhisper, (BYTE*)OnWhisperHook, true);
OnWhisperDet.Apply();
//Channel Buffer Patch
OnChannelChatDet.Detour((BYTE*)OnChannelChat, (BYTE*)OnChannelChatHook, true);
OnChannelChatDet.Apply();
//Stage Buffer Patch
OnStageChatDet.Detour((BYTE*)OnStageChat, (BYTE*)OnStageChatHook, true);
OnStageChatDet.Apply();
MessageBox(0,"LG Anti-Hack Loaded","Coded by Phail and OneWhoSighs",MB_ICONINFORMATION);
}
/********************************************************************************/
//Remove the detours/patches when unloaded
void Shutdown(){
/*Force Stage Patch
OnStageCreateDet.Remove();*/
//Mega PowerLevel Patch
OnGameKillDet.Remove();
//Admin Announce Patch
OnAdminAnnounceDet.Remove();
//Whisper Buffer Patch
OnWhisperDet.Remove();
//Channel Buffer Patch
OnChannelChatDet.Remove();
//Stage Buffer Patch
OnStageChatDet.Remove();
}
/********************************************************************************/
bool WINAPI DllMain(HMODULE hModule, DWORD dwReason, PVOID pvReserved){
if(dwReason == DLL_PROCESS_ATTACH){
ONCE(bHasLoaded)
g_hLocalModule = hModule;
Initialize();
}
}
else if(dwReason == DLL_PROCESS_DETACH){
ONCE(bHasShutdown)
Shutdown();
}
}
return true;
}Connect.h
Code:
// Source written by Envy
// ----------------------
// Allows the user to connect to a remote host when the server
// and port is defined; anything else the user wishes to do afterwards
// (such as packet handling), the user must add manually.
// Include files
#include <iostream>
using namespace std;
// Include ws2_32 library
#pragma comment( lib, "ws2_32.lib" )
// WSAStartup did not return successful; for more information, visit: http://msdn2.microsoft.com/en-us/library/ms742213.aspx
#define STARTUP_ROUTINE_FAILURE 9000
// WSADATA struct variable wVersion, either LOBYTE (x.) or HIBYTE (.x), was invalid; for more information, visit: http://msdn2.microsoft.com/en-us/library/ms741563.aspx
#define INVALID_WINSOCK_VERSION 9001
// Report errors within WSA
void ReportError( DWORD dwError, LPCSTR lpFunction, LPCSTR lpStructVar )
{
char szBuf[128];
ZeroMemory( szBuf, 128 );
WSACleanup( );
// Incorrect version
if( lpFunction == NULL )
{
sprintf( szBuf, "Erorr %d returned by WSADATA::%s.", dwError, lpStructVar );
MessageBoxA( NULL, szBuf, lpStructVar, MB_ICONERROR );
}
// WSA error
else if( lpStructVar == NULL )
{
sprintf( szBuf, "Call to function %s returned error %d.", lpFunction, dwError );
MessageBoxA( NULL, szBuf, lpFunction, MB_ICONERROR );
}
// Unknown error; this should never occur
else
{
MessageBoxA( NULL, "An unkown error has occured.", "Unknown Error", MB_ICONERROR );
}
}
// Connect to a remote host
SOCKET ConnectToRemoteHost( LPCSTR lpServer, USHORT Port )
{
WSADATA WSAData;
WORD wVersionRequested = MAKEWORD( 2, 0 );
int nReturnValue;
int nWSAStartupRoutine = WSAStartup( wVersionRequested, &WSAData );
cout << endl << "Performing WSAStartup routine..." << endl;
// WSAStartup failure
if( nWSAStartupRoutine != 0 )
{
ReportError( STARTUP_ROUTINE_FAILURE, "WSAStartup()", NULL );
return STARTUP_ROUTINE_FAILURE;
}
// Success; this should never happen ;)
else
{
cout << endl << "WSAStartup successful!" << endl
<< endl << "Checking WinSock Library version..." << endl;
}
// Incorrect version
if( LOBYTE( WSAData.wVersion ) != 2 || HIBYTE( WSAData.wVersion ) != 0 )
{
ReportError( INVALID_WINSOCK_VERSION, NULL, "wVersion" );
return INVALID_WINSOCK_VERSION;
}
// Success; this should never happen ;)
else
{
cout << endl << "WinSock Library v" << (int)LOBYTE( WSAData.wVersion ) << "." << (int)HIBYTE( WSAData.wVersion ) << endl
<< endl << "Finding " << lpServer << "..." << endl;
}
LPHOSTENT lpHostEntry;
lpHostEntry = gethostbyname( lpServer );
// Failed to get host
if( !lpHostEntry )
{
nReturnValue = WSAGetLastError( );
ReportError( nReturnValue, "gethostbyname()", NULL );
return -1;
}
// Success; this should never happen ;)
else
{
cout << endl << "Found " << lpServer << "!" << endl
<< endl << "Creating socket..." << endl;
}
SOCKET Socket;
Socket = socket( AF_INET, SOCK_STREAM, 0 );
// Invalid socket (hence INVALID_SOCKET)
if( Socket == INVALID_SOCKET )
{
nReturnValue = WSAGetLastError( );
ReportError( nReturnValue, "socket()", NULL );
return -1;
}
// Success; this should never happen ;)
else
{
cout << endl << "Socket created!" << endl
<< endl << "Connecting to " << lpServer << "..." << endl;
}
SOCKADDR_IN ServerInfo;
ServerInfo.sin_addr = *((LPIN_ADDR) *lpHostEntry->h_addr_list);
ServerInfo.sin_family = AF_INET;
ServerInfo.sin_port = htons( Port );
int nConnect = connect( Socket, (LPSOCKADDR) &ServerInfo, sizeof( struct sockaddr ) );
// Socket error (hence SOCKET_ERROR)
if( nConnect == SOCKET_ERROR )
{
nReturnValue = WSAGetLastError( );
ReportError( nReturnValue, "connect()", NULL );
return -1;
}
// Success; this should never happen ;)
else
{
cout << endl << "Connected to " << lpServer << "!" << endl
<< endl << "[Press 'enter' to continue...]";
//cin.get( );
}
return Socket;
}For anyone wondering--Phun = Envy = Travis Padgett
Please use this instead:
Code:
/***********************************************************************************************
Connect.h
Creator(s):
* Travis Padgett
Build Version:
* v3.0 - STABLE
List of Functions:
* Connect( LPCSTR lpHostName, WORD nPortNo )
- Connects to the specified host through the specified port.
***********************************************************************************************/
// --------------------------------------------------
// Header Section
#include <stdio.h>
#include "ReportError.h"
// Include ws2_32 library
#pragma comment( lib, "ws2_32.lib" )
// Ignore deprecated commands
#pragma warning( disable : 4996 )
// --------------------------------------------------
// Constant Section
// WSAStartup did not return successful; for more information, visit: http://msdn2.microsoft.com/en-us/library/ms742213.aspx
#define STARTUP_ROUTINE_FAILURE -1
// WSADATA struct variable wVersion, either LOBYTE (x.) or HIBYTE (.x), was invalid; for more information, visit: http://msdn2.microsoft.com/en-us/library/ms741563.aspx
#define INVALID_WINSOCK_VERSION -1
// --------------------------------------------------
// Function Section
SOCKET Connect( LPCSTR lpHostName, WORD nPortNo )
{
WSADATA WSAData;
WORD wVersionRequested = MAKEWORD( 2, 0 );
int nWSAStartupRoutine = WSAStartup( wVersionRequested, &WSAData );
// WSAStartup error.
if( nWSAStartupRoutine != 0 )
{
ReportError( STARTUP_ROUTINE_FAILURE, "WSAStartup( )" );
return STARTUP_ROUTINE_FAILURE;
}
// Invalid WinSock version.
if( LOBYTE( WSAData.wVersion ) != 2 || HIBYTE( WSAData.wVersion ) != 0 )
{
ReportError( INVALID_WINSOCK_VERSION, "wVersion.x" );
return INVALID_WINSOCK_VERSION;
}
LPHOSTENT lpHostEntry;
lpHostEntry = gethostbyname( lpHostName );
// Could not get host.
if( !lpHostEntry )
{
ReportError( WSAGetLastError( ), "gethostbyname()" );
return 0;
}
SOCKET sSocket;
sSocket = socket( AF_INET, SOCK_STREAM, 0 );
// Could not create socket.
if( Socket == INVALID_SOCKET )
{
ReportError( WSAGetLastError( ), "socket()" );
return -1;
}
SOCKADDR_IN ServerInfo;
ServerInfo.sin_addr = *((LPIN_ADDR) *lpHostEntry->h_addr_list);
ServerInfo.sin_family = AF_INET;
ServerInfo.sin_port = htons( nPortNo );
int nConnect = connect( sSocket, (LPSOCKADDR) &ServerInfo, sizeof( struct sockaddr ) );
// Could not connect to socket.
if( nConnect == SOCKET_ERROR )
{
ReportError( WSAGetLastError( ), "connect()" );
return -1;
}
return sSocket;
}
Code:
/***********************************************************************************************
ReportError.h
Creator(s):
* Travis Padgett
Build Version:
* v1.0 - STABLE
List of Functions:
* ReportError( DWORD dwError, LPCSTR lpFunction )
- Displays a message box containing the last known error.
***********************************************************************************************/
void ReportError( DWORD dwError, LPCSTR lpFunctionName )
{
// Buffer.
char szBuffer[128];
// Fills buffer with '00'.
ZeroMemory( szBuffer, sizeof( szBuffer ) );
// Writes the string to the buffer.
sprintf( szBuffer, "Call to function %s returned error %d.", lpFunctionName, dwError );
// Displays a message box containing the error.
MessageBoxA( NULL, szBuffer, lpFunctionName, MB_ICONERROR );
}
Last edited by a moderator:
cant anyone just do this and release?
